Blocking direct access to ajax source

Question

I made a calculator. I want to prevent that people can use the ajax.php to get the results without accessing the webpage. They have to use the API for that purpose.

I suppose I can add a key (timestamp encoded with symmetrical encryption) inside the webpage. When I will call the ajax.php, I will send also the key. On the server side, I will decode the key, extract the timestamp and check if the key was not generated too long ago.

I can also generate a one time key inside the database.

Do you have better ideas?

Answer 1

• You can also use the CSRF token functionality available in most of the web development framework. CSRF is stored in web page's header metadata and must be sent across for each ajax request. CSRF is assigned when a full page is rendered by the server.

  If CSRF token doesn't exist in ajax request, or if CSRF is wrong then just don't process the request. This way you make sure the user was logged in the actual interface.

• Perform session validation of each ajax request.

You can use these within an API call too.

Still it will help to protect from some web intercept proxies or custom made html web client scripts.